The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.
CVE-2026-109665 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.108.0 and 16.x before 16.18.0. It allows authenticated low-privileged users to call certain endpoints without proper permission checks, enabling them to deactivate master records and modify data beyond their roles.
Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role can call the affected endpoints to change a field on record types outside their role's permissions, tampering with data they should not control.
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional email for documents they are not permitted to read.
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned role permits.
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.
CVE-2026-84316 is an improper input validation vulnerability in 0xJacky's nginx-ui that allows authenticated users to bypass directive validation by placing blocked directives after a semicolon on the same line. This bypass affects all guarded write paths that call the validator, enabling injection of dangerous nginx directives such as js_import, load_module, and user root. On deployments with njs or perl modules enabled, this leads to code execution in the nginx worker process, potentially as root. The vulnerability requires authentication via node secret or user JWT and has been demonstrated on version 2.3.11 of the official Docker image. The issue stems from the validator splitting config content by newlines and only inspecting the first token per line, while nginx parses multiple directives separated by semicolons on the same line.
Open WebUI versions from 0.6.31 up to but not including 0.11.4 contain a stored cross-site scripting (XSS) vulnerability in the Markdown renderer. This vulnerability arises because user-authored tool-call detail blocks are treated as tool output and their embeds attribute is mounted in script-enabled iframes. Authenticated users can exploit this by posting crafted messages or citation content that execute JavaScript in other users' browsers, potentially enabling in-app phishing or session hijacking if iframeSandboxAllowSameOrigin is enabled.
Open WebUI versions from 0.11.0 up to but not including 0.11.4 contain a regular expression denial of service (ReDoS) vulnerability. Authenticated users can exploit this flaw by providing file search patterns that cause catastrophic backtracking in regex processing, stalling server workers and blocking the event loop for approximately two seconds per repeated call. This vulnerability is fixed in version 0.11.4.
RT-Thread versions through 5.3.0 have a memory corruption vulnerability in the legacy USB CDC virtual COM port driver. This flaw occurs because the rx_ringbuffer is aliased as a Serial V2 rt_serial_rx_fifo in the _function_enable() function. When a connected USB host configures the CDC device, it can cause writes beyond the ring buffer into adjacent memory structures and trigger an invalid rt_free() call upon device close. This results in a denial of service condition.
jshERP versions up to 3.6 have an improper authorization vulnerability that allows low-privilege authenticated users to access settlement account ledgers beyond their permitted scope by manipulating the accountId parameter in a specific API call. This enables unauthorized viewing of sensitive financial details such as bill numbers, counterparties, amounts, and remarks within the tenant.
CVE-2026-108809 is a medium severity vulnerability in Eleveo Call Recording Software versions 10.0 through 10.3.0. It involves improper handling of the /auth/realms/default/protocol/openid-connect/logout endpoint, leading to session expiration. The vulnerability can be exploited remotely and requires low privileges with user interaction. The vendor has not responded to disclosure requests, and no patch or official remediation is currently available.
CVE-2026-108808 is a low-severity vulnerability in Eleveo Call Recording Software up to version 10.3.0. It involves the use of the GET request method with sensitive query strings in the JWT Token Handler component, specifically in the /auth/realms/default/protocol/openid-connect/logout endpoint. The vulnerability arises from manipulation of the id_token_hint argument, which may expose sensitive information via query strings. Exploitation is difficult and requires high complexity. The vendor has not responded to disclosure, and no official patch or remediation is currently available.
CVE-2026-108768 is a medium severity vulnerability in zhayujie CowAgent up to version 2.2.0. It involves the json.loads function in the Streaming Tool-Call Argument Handler component, where remote manipulation can lead to resource allocation issues. The vulnerability can be exploited remotely, and public exploit code is available. The vendor has not responded to disclosure attempts, and no patch or remediation information is currently available.
Frappe CRM versions 1.49.0 through 1.87.0 have a missing authorization vulnerability in the crm.api.doc.get_linked_docs_of_document function. This flaw allows authenticated users to access linked documents without proper permission checks, potentially exposing sensitive information such as call log phone numbers, deal organizations, and mention notification text. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows any authenticated user to modify tenant settings via a specific API call. This flaw permits low-privileged attackers to change the applyStatus field of any tenant by supplying its tenant ID, potentially enabling or disabling tenant administrator applications across tenants. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-108593 is a high-severity code injection vulnerability in decolua 9router versions 0.4.1 through 0.5.99. It affects the POST /api/cli-tools/hermes-settings endpoint, allowing authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. By submitting a specially crafted baseUrl containing double quotes and newlines, attackers can add a hooks_auto_accept setting and a hooks.post_llm_call shell command. This command is executed by the Hermes Agent without user approval after an LLM call, potentially enabling unauthorized code execution.